Remarks 

Rejections Under 35 U.S.C. § 101 

Claims 1, 5, 7-8, 12-13 and 17 were rejected under 35 U.S.C. § 101 as being 
directed to non- statutory subject matter. As discussed in the Examiner Interview on 
March 17, 2009, the rejected claims are all tied to specific hardware (e.g., web 
application server) and are statutory under § 101. 



Rejections Under 35 U.S.C. § 102 

Claims 1, 5, 7-8, 12-18, 20, 23, 25, 27-29, 31, 34-36, 39 and 42-43 were rejected 
under 35 U.S.C. § 102(a) as being anticipated by NPL1 to Dessiatnikov "Securing SZL 
Connection String"(GIAC Security Essentials Certification Practical Assignment - 
version 1.4b Option 1 SANS Institute January 8, 2004) (Dessiatnikov). Claims 5, 7, 31, 
34-35 and 42-43 have been cancelled, rendering the rejection of these claims moot. 
Applicant submits the remaining claims are not anticipated by Dessiatnikov for at least 
the reasons set forth below. 

Claim 1 has been amended to recite, in part, the following: 

accessing a user-configurable key phrase from a key phrase file 
located in a shared directory accessible by a plurality of web application 
servers in response to receiving the database access statement; 

combining a system identifier of the web application server with 
the user-configurable encryption key phrase to create an encryption key; 

obtaining an encrypted string from a secure storage file in the 
shared directory via a find operation; 

parsing the encrypted string into substrings; and 

decrypting one of the substrings with the encryption key to obtain 
connection information to a database including a password and an address 
for the database. 
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Independent claims 18, 31, 36 and 39 recite similar limitations. The Office action 
cites Dessiatnikov as disclosing the limitations of claim 1 . Applicant submits 
Dessiatnikov fails to disclose the limitations cited above "in as complete detail as is 
contained in the claim," as required by Richardson v. Suzuki Motor Co. (868 F.2d 1226, 
1236, 9 USPQ2d 1913, 1920 (Fed Cir. 1989)). Furthermore, per NetMoneyln v. Verisign 
(Fed Cir. 2008), 35 U.S.C. § 102 "embodies the concept of novelty — if a device or 
process has been previously invented (and disclosed to the public), then it is not new, and 
therefore the claimed invention is 'anticipated' by the prior invention. . . . Because the 
hallmark of anticipation is prior invention, the prior art reference — in order to anticipate 
under 35 U.S.C. § 102 — must not only disclose all elements of the claim within the four 
corners of the document, but must also disclose those elements 'arranged as in the 
claim.'" 

Given the law set forth above, Applicant submits that Dessiatnikov does not 
disclose the above recited limitations as arranged in the claim . For example, claim 1 
recites accessing a user-configurable key phrase from a shared directory that is accessible 
by a plurality of web application servers in response to receiving a database access 
statement. Paragraph 3 of the section entitled "Encrypting Data" in Dessiatnikov is cited 
as disclosing accessing a key phrase from a directory. The cited portion actually 
discusses Microsoft's DPAPI as a protection service that functions on the operating 
system level. It is alleged in Dessiatnikov that DPAPI generates user-specific or machine 
specific encryption keys. However, Dessiatnikov does not explain how the encryption 
keys are generated. Even if one were to assume that a DPAPI machine-specific key, for 
example, includes a component derived from a system identifier (which is not conceded 
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as being disclosed by Dessiatnikov), there is no indication of another component being a 
user-configurable encryption key phrase accessed from a shared directory that is 
accessible by a plurality of web application servers. 

Furthermore, Applicant submits Dessiatnikov fails to disclose parsing the 
encrypted string into substrings and decrypting one of the substrings. The cited portion 
of Dessiatnikov merely discusses general properties of connection strings. There is 
nothing explicit disclosed in Dessiatnikov about parsing an encrypted connection string 
and decrypting one of the substrings to obtain database connection information. Nor does 
the Office action or Dessiatnikov provide any basis in fact or technical reasoning to 
establish the inherency of parsing an encrypted connection string and decrypting one of 
the substrings to obtain database connection information. Applicant asserts that the lack 
of basis and/or technical reasoning is because it is simply not inherent to parse an 
encrypted connection string and decrypt one of the substrings to obtain database 
connection information. 

For at least the reasons set forth above, Applicant submits claims 1, 18, 31, 36 and 
39 are not anticipated by Dessiatnikov. 

Applicant submits the remaining dependent claims are also not anticipated by 
Dessiatnikov for at least the same reasons claims 1, 18, 31, 36 and 39 are not anticipated. 
Rejections Under 35 U.S.C. § 103 

Claim 30 was rejected under 35 U.S.C. § 103(a) as being obvious in view of 
Dessiatnikov and further in view of U.S. Patent Publication No.: 2003/0105977 to 
Brabson et al. (Brabson). Claim 30 depends from claim 18 and necessarily includes the 
limitations of the independent claim. According to the discussion above, Dessiatnikov 
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fails at least to disclose various limitations of claim 18. Whether or not Brabson 
discloses the limitations cited in the Office action, which Applicant does not concede, 
Brabson does not cure the deficiencies of Dessiatnikov. Accordingly, Applicant submits 
claim 30 is not obvious in view Dessiatnikov and Brabson. 
Conclusion 

For at least the foregoing reasons, Applicant submits that the rejections have been 
overcome. Therefore, claims 1, 8, 12-18, 20, 23, 25, 27-29, 36 and 39 are in condition 
for allowance and such action is earnestly solicited. The Examiner is respectfully 
requested to contact the undersigned by telephone if such contact would further the 
examination of the present application. 

Please charge any shortages and credit any overcharges to our Deposit Account 
number 02-2666. 



Respectfully submitted, 

BLAKELY, SOKOLOFF, TAYLOR & ZAFMAN, LLP 



April 17, 2009 



/Jared S. Engstrom/ 



Date 



Jared S. Engstrom 
Reg. No. 58,330 
Attorney for Applicant 



1279 Oakmead Parkway 
Sunnyvale, CA 94085-4040 
Telephone: 503-439-8778 



I hereby certify that this correspondence is being submitted electronically via EFS Web on the date shown below: 
Date: 4/17/2009 /Heidi Yerton/ 

Heidi Yerton 
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